{"id":"CVE-2026-119568","kind":"vulnerability","aliases":["CVE-2026-119568"],"related":[],"title":"vsftpd: TLS session reuse lets attackers hijack FTPS data connections","description":"vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's source IP can obtain a ticket via AUTH TLS, then connect to the victim's PASV port to steal downloads or inject upload data.","summary":"vsftpd through 3.0.5 only checks that the FTPS data connection resumed some TLS ticket it can decrypt, not the same control session. An unauthenticated attacker sharing the victim's source IP can resume their own ticket on the victim's PASV port to steal downloads or inject uploads. No upstream fix; latest release is 3.0.5. Public PoC.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"vsftpd","fixed":[],"affected":"<= 3.0.5","ecosystem":"vendor"}],"ecosystems":[],"tags":["ftp","ftps","linux","runtime","self-hosted","tls","vsftpd"],"not_affected_if":["inetd-mode","no-ftps","other-ftp-server","require_ssl_reuse-not-the-issue","ssl_enable-no"],"how_to_check":"- Run `vsftpd -v` (or your package manager) — every release up to and including 3.0.5 is affected; 3.0.5 is the latest upstream release.\n- Check that your build has SSL and it is on: `grep -E '^(ssl_enable|listen|require_ssl_reuse)' /etc/vsftpd.conf` (also /etc/vsftpd/vsftpd.conf). Exposed per the researcher: ssl_enable=YES, standalone listen=YES (or listen_ipv6=YES), require_ssl_reuse=YES (the default). The stock upstream tarball compiles SSL out, but most distro packages compile it in.","fix":null,"status":"open","published_at":"2026-10-30T12:16:44+00:00","first_seen_at":"2026-10-30T12:30:27+00:00","triaged_at":"2026-10-30T12:31:55+00:00","updated_at":"2026-10-30T12:32:54+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-30T12:31:55Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources do not state a fixed version.","reach":"network","title":"vsftpd: TLS session reuse lets attackers hijack FTPS data connections","impact":"high","summary":"vsftpd through 3.0.5 has an authentication bypass in ssl_data_accept() that lets an unauthenticated attacker hijack FTPS data connections by resuming their own TLS session ticket. An attacker sharing the victim's source IP can steal downloads or inject uploaded data.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["vsftpd","ftp","ftps","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker steals file downloads or injects data into uploads","analyst_note":"Check the NVD entry and vsftpd upstream for a fixed version and whether FTPS must be enabled for exposure; the sources give no fix.","how_to_check":"- Check the installed version with `vsftpd -v` or the package manager, and compare against `3.0.5`.\n- Confirm whether FTPS is enabled in the vsftpd config (`ssl_enable=YES`).\n- unknown for any further checks the sources do not state.","plain_action":"","needs_analyst":true,"not_affected_if":["no-ftps","other-ftp-server"],"who_is_affected":"Servers running vsftpd 3.0.5 or earlier with FTPS (TLS) enabled are exposed, since the flaw is in the TLS data-connection handling. Attackers on the same source IP as a victim, or who can share it, can take over data transfers. Servers that do not offer FTPS or that run a different FTP server can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000728,"input_tokens":4159,"output_tokens":625,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the NVD entry and vsftpd upstream for a fixed version and whether FTPS must be enabled for exposure; the sources give no fix.","search":"'-119568':13A,16A '-2026':12A,15A '3.0.5':29B,81B,86C 'accept':95C 'allow':97C 'attack':6A,51B,99C,112C 'auth':124C 'authent':89C 'bypass':90C 'check':31B 'connect':10A,36B,104C,127C 'contain':87C 'control':47B 'cve':11A,14A 'data':9A,35B,94C,103C,140C 'decrypt':43B 'download':71B,136C 'fix':77B 'ftp':18B 'ftps':8A,19B,34B,102C 'hijack':7A,101C 'host':24B 'inject':73B,138C 'ip':57B,118C 'latest':78B 'let':5A 'linux':20B 'obtain':120C 'pasv':67B,132C 'poc':83B 'port':68B,133C 'public':82B 'releas':79B 'resum':37B,59B,106C 'reus':4A 'runtim':21B 'self':23B 'self-host':22B 'session':3A,48B,110C 'share':52B,113C 'sourc':56B,117C 'ssl':93C 'steal':70B,135C 'ticket':40B,62B,111C,122C 'tls':2A,25B,39B,109C,125C 'unauthent':50B,98C 'upload':74B,139C 'upstream':76B 'via':123C 'victim':54B,65B,115C,130C 'vsftpd':1A,17A,26B,27B,84C 'vulner':91C","nicknames":[],"mitigations":[],"who_affected":"Servers running vsftpd 3.0.5 or earlier with FTPS enabled (ssl_enable=YES) in standalone mode, including distro packages that compile in OpenSSL. An attacker who shares the victim's source IP (same NAT, office or shared host) can open their own AUTH TLS session with no login, then resume that ticket on the victim's passive data port to read a download or inject an upload. Plain-FTP-only servers, SFTP/other FTP servers and anyone with ssl_enable=NO can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T12:16:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-119568","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119568","severity":null,"published_at":"2026-10-30T12:16:44+00:00","modified_at":"2026-10-30T12:16:44+00:00","first_seen_at":"2026-10-30T12:30:27+00:00","fetched_at":"2026-10-30T12:30:27+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119568:1151","url":null,"severity":null,"published_at":"2026-10-30T12:32:54+00:00","modified_at":"2026-10-30T12:32:54+00:00","first_seen_at":"2026-10-30T12:32:54+00:00","fetched_at":"2026-10-30T12:32:54+00:00","note":"NVD/VulnCheck CVE-2026-119568 from Abraxas Labs 12 Oct 2026 research (public PoC, repo abraxas/vsftpd-ssl-data-any-ticket linked from page, not fetched). Vendor page (security.appspot.com) lists 3.0.5 as latest, no advisory/fix: fix-status none. Researcher rates 7.4 (CVSS3.1, AC:H); VulnCheck 9.1 CVSS4. Exploitation in wild not reported. Mitigation ideas not vendor-sourced so left out; do NOT set require_ssl_reuse=NO (weakens further). Nothing marked verified: vendor page does not discuss the flaw. Check distro trackers (Debian/Fedora) for backports."}],"documents":[{"id":23433,"url":"https://security.appspot.com/vsftpd.html","title":"vsftpd project page (latest release v3.0.5)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":23435,"url":"https://abraxaslabs.tech/research/vsftpd-ssl-data-any-ticket","title":"Abraxas Labs: vsftpd FTPS data accepts any resumed ticket (analysis + PoC)","kind":"poc","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":23437,"url":"https://www.vulncheck.com/advisories/vsftpd-through-3.0.5-require-ssl-reuse-bypass-via-ftps-data-channel-hijacking","title":"VulnCheck advisory CVE-2026-119568","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}